---
title: Multiply-Shift Hashing
url: https://www.emergentmind.com/topics/multiply-shift-hash-family
type: topic
---

# Multiply-Shift Hashing

Multiply-shift hashing is a word-arithmetic hash family that multiplies a key by a uniformly selected odd machine-word multiplier modulo a power of two and retains the most significant bits of the result. For a word universe $q=2^r$ and a table of size $m=2^\ell$, its standard form is
$$
h_a(x)=\bigl((ax)\bmod 2^r\bigr)\gg(r-\ell),
$$
with output in $\{0,\ldots,2^\ell-1\}$. The oddness of $a$ makes it invertible modulo $2^r$. The family is distinguished from affine prime-modulus hashing and from iterative affine hash generation used in MinHash. Its implementation advantages arise from machine-word multiplication, implicit modular reduction through overflow, and bit truncation; its theoretical behavior reflects substantial arithmetic structure rather than full randomness.

## 1. Definition and arithmetic structure

Let $q=2^r$ denote the word universe, let $m=2^\ell$ be the number of buckets, and assume $0\le \ell\le r$. A multiplier $a$ is sampled uniformly from the odd residues
$$
\mathbb Z_q^*=\{1,3,5,\ldots,2^r-1\}.
$$
For a key $x\in\mathbb Z_q$, the multiply-shift function is
$$
h_a(x)=\left\lfloor\frac{(ax\bmod 2^r)}{2^{r-\ell}}\right\rfloor
      =\bigl((ax)\bmod 2^r\bigr)\gg(r-\ell).
$$

The output consists of the $\ell$ most significant bits of the product $ax\bmod 2^r$. Equivalently, multiplication partitions the word universe into $m$ consecutive intervals, each of width
$$
B=\frac qm=2^{r-\ell}.
$$
Bucket $y$ contains precisely those products whose representatives lie in
$$
\left[y\frac qm,(y+1)\frac qm\right).
$$

The multiplier is restricted to odd residues because odd elements are invertible modulo $2^r$. This invertibility is central both to the conventional construction and to analyses of its collision and maximum-load behavior. There is no additive parameter $b$ in the family considered in the standard theoretical formulation.

Multiply-shift hashing is therefore not a hash into residue classes modulo $m$. It is multiplication modulo $2^r$ followed by high-bit extraction. This distinction is important because the final projection has interval geometry: a bucket corresponds to a consecutive interval in $\mathbb Z_q$, rather than to a congruence class.

## 2. Relation to affine and prime-modulus hashing

A related affine family over a prime modulus is
$$
h_{a,b}(x)=((ax+b)\bmod p)\bmod m,
$$
where $a$ and $b$ are independently and uniformly selected from $\mathbb Z_p$. Here $p$ is prime, the intermediate value is computed modulo $p$, and the final operation reduces modulo $m$. The family used in multiply-shift hashing instead has modulus $q=2^r$, no additive shift, and a high-bit projection.

The two constructions can be contrasted as follows:

| Property | Prime-modulus affine hashing | Multiply-shift hashing |
|---|---|---|
| Modulus | Prime $p$ | $q=2^r$ |
| Parameters | $a,b$ | Odd multiplier $a$ |
| Final projection | Reduction modulo $m$ | Retain $\ell$ high bits |
| Bucket geometry | Residue classes after reduction | Consecutive intervals of width $q/m$ |

The expression “linear hashing” is potentially misleading for the prime-modulus family because the final reduction modulo $m$ destroys linearity. Multiply-shift likewise does not preserve the usual finite-field or vector-space structure; its principal appeal is that multiplication modulo a power of two and bit shifting are efficient machine operations.

The affine prime-modulus family is the baseline used in Carter–Wegman-style universal hashing. In contrast, the multiply-shift family analyzed by Dietzfelbinger, Hagerup, Katajainen, and Penttonen uses a uniformly random odd multiplier and truncation of the product. The two families nevertheless admit closely related geometric analyses of heavy buckets.

## 3. Universal hashing and load guarantees

For a fixed set $X$ of $n$ distinct keys, let
$$
M(h,X)=\max_{y\in[m]}|\{x\in X:h(x)=y\}|
$$
denote the maximum bucket load, equivalently the longest chain when hashing with chaining.

For multiply-shift hashing, the established upper bound applies when
$$
q=2^r,\qquad m=2^\ell,\qquad q\ge m\ge n,
$$
and $X\subseteq\mathbb Z_q$ is arbitrary and fixed. The expectation is over the uniformly random odd multiplier $a$. The bound is
$$
\mathbb E[M]=O\!\left((n\log n)^{1/3}\right)
=\widetilde O(n^{1/3}).
$$
This result is proved for the multiply-shift family in “Linear Hashing is Awesome” [1706.02783].

The theorem is an expectation bound, not a high-probability statement. It does not assert that the family behaves as a fully random function, nor does it establish the usual pairwise collision guarantee as its principal conclusion. For $m=n$, fully random hashing has maximum load typically about
$$
\frac{\log n}{\log\log n}
$$
with high probability, whereas the $\widetilde O(n^{1/3})$ guarantee is substantially larger. The result instead exploits arithmetic structure to improve the generic $O(\sqrt n)$ expected longest-chain bound associated with arbitrary 2-independent hashing.

The proof establishes a tail estimate of the form
$$
\Pr[M\ge 4\alpha]
=O\!\left(\frac{n\log n}{\alpha^3}\right)
$$
for $1\le\alpha\le n/4$. Summing this tail with
$$
T=\left\lceil(n\log n)^{1/3}\right\rceil
$$
gives the stated expectation bound. The cubic exponent arises from converting heavy-bucket events into a lower bound on the number of close pairs produced by multiplication.

## 4. Geometric interpretation of heavy buckets

For multiply-shift hashing, bucket $y$ is exactly the interval
$$
\left[y\frac qm,(y+1)\frac qm\right)
$$
in the word universe. Consequently, if $M$ keys collide in one bucket, then the transformed set
$$
aX=\{ax\bmod q:x\in X\}
$$
contains $M$ points in an interval of length $q/m$.

The proof studies the event $M\ge4\alpha$. It introduces auxiliary multipliers whose canonical representatives are primes in $(\alpha,2\alpha)$. If many such multipliers produce heavy buckets, an interval argument implies that the original key set contains many ordered pairs whose transformed differences are small:
$$
|a(x-x')|_q<\frac{q}{m\alpha}.
$$

For distinct keys $x$ and $x'$, multiplication by their nonzero difference does not behave identically to a fully random mapping, but the invertibility of odd multipliers allows the probability of this close-pair event to be bounded by
$$
\Pr\left[|a(x-x')|_q<\frac{q}{m\alpha}\right]
\le \frac{4}{m\alpha}.
$$
Summing over ordered pairs yields an upper bound on the expected number of close pairs. A technical interval lemma supplies a competing lower bound whenever many multipliers induce heavy buckets. Combining the two bounds produces
$$
\Pr[M\ge4\alpha]
=O\!\left(\frac{n\log n}{\alpha^3}\right).
$$

The interval geometry differs slightly from that of affine hashing modulo a prime. In the prime-modulus case, collisions correspond to concentration in a residue class modulo $m$, which can be transformed into concentration inside a short cyclic interval. In multiply-shift hashing, the high-bit projection directly identifies a heavy bucket with concentration in a consecutive interval.

## 5. Lower bounds and adversarial key sets

The upper bound does not imply that multiply-shift hashing has polylogarithmic maximum load on every key set. “Linear Hashing is Not That Awesome” [2608.23502] proves that, for sufficiently large word modulus, there exist sets of keys with substantially larger expected maximum load.

Let
$$
q=2^w,\qquad m=2^\ell,\qquad B=q/m,
$$
and let $m=\Theta(n)$. For fixed constants $0<c<C$ and $0<\eta<\log 2/3$, define
$$
K_0=\exp\left(
\left(\frac{\log 2}{3}-\eta\right)
\frac{\log n}{\log\log n}
\right).
$$
For sufficiently large $n$, every power of two $m$ satisfying $cn\le m\le Cn$, and every power of two $q$ satisfying $q\ge mK_0$, there exists a set $X\subseteq\mathbb Z_q$ of $n$ keys such that
$$
\mathbb E_a\!\left[ML(MS_a^{q,m},X)\right]
=\Omega(K_0).
$$
Equivalently,
$$
\mathbb E_a[ML]
\ge
\exp\left(
\left(\frac{\log 2}{3}-o(1)\right)
\frac{\log n}{\log\log n}
\right)
=
n^{\Omega(1/\log\log n)}.
$$

This is an existential worst-case statement: for each permitted parameter regime, a particular key set exists. It is not a claim that ordinary or randomly selected key sets exhibit this load. The expectation is over the random odd multiplier, and a constant fraction of admissible multipliers produce load $\Omega(K_0)$ for the constructed set. Thus the phenomenon is not attributed solely to an extremely rare multiplier.

The result establishes a super-polylogarithmic lower bound while leaving open whether the worst-case expected maximum load is polynomial in $n$. In particular, it remains open whether there exists a constant $c>0$ such that some key set satisfies
$$
\mathbb E_a[ML]\ge n^c.
$$

## 6. Additive combinatorics and arithmetic Kakeya sets

The lower-bound construction connects maximum-load analysis to a density variant of the arithmetic Kakeya problem. For a set $X\subseteq\mathbb Z_p$, a length parameter $L$, and a nonzero difference $d$, define
$$
R_{X,L}(d)=
\max\{|J|:c+dJ\subseteq X
\text{ for some }c\in\mathbb Z_p,\ J\subseteq[L]\}.
$$
The subset $J$ need not be an interval or contain an arithmetic progression. This flexibility motivates the term dense arithmetic Kakeya set.

For prime-modulus affine hashing, with
$$
L=\left\lceil\frac pm\right\rceil,
$$
the expected maximum load is equivalent, up to constant factors and the contribution from $a=0$, to the average directional richness
$$
\frac1p\sum_{d\in\mathbb Z_p^*}R_{X,L}(d).
$$
The multiply-shift analogue replaces bounded modular progressions with short cyclic intervals of length at most $B=q/m$. If $K$ transformed points lie in such an interval, the interval intersects at most two consecutive high-bit buckets, so one bucket contains at least $K/2$ points.

The lower-bound construction uses a construction of Green and Ruzsa. For the first $t$ odd primes $q_1,\ldots,q_t$, let
$$
Q_t=\prod_{i=1}^tq_i,
\qquad
\rho_t=\prod_{i=1}^t\left(1+\frac1{q_i}\right).
$$
There is a set
$$
S\subseteq\{1,\ldots,KQ_t\}
$$
whose size satisfies
$$
|S|\le K^2Q_t\,2^{-t}\rho_t
$$
and which contains a complete $K$-term arithmetic progression for every integer difference from $1$ through $Q_t-1$.

Difference amplification transforms these progressions into rich sets of modular differences. For multiply-shift hashing, odd differences and odd multipliers are used because only odd elements are invertible modulo $2^w$. Appropriate parameter choices produce $\Omega(q)$ distinct good odd multipliers. For each such multiplier, a $K$-term progression is mapped into a cyclic interval shorter than one bucket width:
$$
RK\le \frac q{32m}<\frac qm.
$$
At least $K/2$ transformed keys consequently occupy one bucket, yielding the lower bound on expected maximum load.

## 7. Practical variants, MinHash, and limitations

The iterative affine construction described in “Iterative Universal Hash Function Generator for Minhashing” [1401.6124] is related to multiply-based universal hashing but is not the standard multiply-shift family. Its baseline is
$$
h(x)=(ax+b)\bmod P,
$$
where $P$ is a large prime. For MinHash, each feature is hashed and the feature attaining the minimum value is retained:
$$
mh_i(o_j)=\underset{x\in o_j}{\arg\min}\;h_i(x).
$$

The paper generates a sequence of affine functions using
$$
h_i(x)=((a+i)x+ib)\bmod P.
$$
For a fixed feature, consecutive values satisfy
$$
h_i(x)=\bigl(h_{i-1}(x)+(x+b)\bmod P\bigr)\bmod P.
$$
Thus, after one initial multiplication, subsequent values can be generated using modular additions. The construction reduces coefficient storage from $O(2N)$ values for $N$ independently parameterized affine functions to $O(2)$ initial values. It is therefore an iterative Carter–Wegman-style affine generator modulo a prime, not a machine-word multiply-shift implementation.

The distinction has practical consequences. Multiply-shift uses implicit modulo-$2^w$ arithmetic and high-bit extraction, whereas the iterative MinHash construction uses an arbitrary prime modulus and a recurrence that avoids repeated affine multiplications. The former is not a drop-in replacement when a prime-modulus affine family or a MinHash-specific recurrence is required; the latter is not a substitute for word-level multiply-shift when power-of-two bucket ranges and native machine arithmetic are the target.

Multiply-shift’s principal limitations are structural. Its hash values are correlated through multiplication by one random multiplier, and the family is not fully random. Its worst-case expected maximum load is now known to be super-polylogarithmic for suitable key sets, despite the earlier $\widetilde O(n^{1/3})$ upper bound. Arbitrary word-modulus arithmetic can also differ in cost from prime-modulus reduction, although multiply-shift benefits from efficient hardware multiplication, overflow semantics, and right shifts.

The current theoretical picture is therefore bounded between
$$
n^{\Omega(1/\log\log n)}
\quad\text{and}\quad
\widetilde O(n^{1/3})
$$
for worst-case expected maximum load when $m=\Theta(n)$ in the relevant parameter regimes. Improving the upper bound substantially would imply progress on standard arithmetic Kakeya questions, while stronger lower bounds could follow from constructions for the weaker density-Kakeya formulation.

Source: https://www.emergentmind.com/topics/multiply-shift-hash-family